Backup CiviCRM and Drupal databases using Backup and Migrate 3.x dev version - NOT 3.1 as this does not have the necessary patch

Disable CiviCRM logging - this can interfere with database writes

Put the site into maintenance mode

Disable all none essential CiviCRM modules - not CiviCRM itself

Backup CiviCRM module code and delete original

Expand new module code in it's place

Clear /sites/default/files/civicrm/templates_c

Run the upgrade script - /?q=civicrm/upgrade&reset=1

Do a victory dance / curse profusely depending on how that went

Re-enable modules

Take site out of maintenance mode

Re-enable CiviCRM logging

Flush caches

That's basically it, but stick close to the list and pay attention! The key factor is to run this on your development server first and fix any issues there - once it's all clear on dev, you have a reasonable chance of things going smoothly on the live site.

Security

This is a security patch, so get to it!

Edit

4.7.21 has a bug in the online membership process, fix can be found here.